{"id":"CVE-2026-112314","kind":"vulnerability","aliases":["CVE-2026-112314"],"related":[],"title":"MIT Kerberos 5: RPC client leaks memory, letting remote attackers exhaust resources","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.","summary":"The GSS-RPC client in MIT Kerberos 5 (krb5) does not free the RPC reply verifier between retries. A remote attacker who injects RPC replies with mismatched XIDs or triggers authentication retries can make the client leak memory, causing denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"krb5","fixed":["1.22.3"],"affected":"< 1.22.3 (earliest affected release unknown)","ecosystem":"vendor"}],"ecosystems":[],"tags":["gss-rpc","kerberos","krb5","linux","package"],"not_affected_if":["no-gss-rpc-clients"],"how_to_check":"- Run krb5-config --version or klist -V; versions before 1.22.3 are unpatched per MITKRB5-SA-2026-001 (the advisory does not list the earliest affected release).\n- Check whether anything links libgssrpc (e.g. ldd on kadmin or custom GSS-RPC clients); if nothing does, you can skip this.\n- Distro packages may backport the fix: check the package changelog for CVE-2026-112314.","fix":"Upgrade MIT krb5 to 1.22.3 or later (MITKRB5-SA-2026-001), or a distro build that backports it.","status":"open","published_at":"2026-11-09T19:16:39+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","triaged_at":"2026-11-09T19:29:46+00:00","updated_at":"2026-11-09T19:37:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T19:29:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MIT Kerberos 5: RPC client leaks memory, letting remote attackers exhaust resources","impact":"medium","summary":"The GSS-RPC client in MIT Kerberos 5 (krb5) does not free the RPC reply verifier between retries. A remote attacker who injects RPC replies with mismatched XIDs or triggers authentication retries can make the client leak memory, causing denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kerberos","krb5","gss-rpc","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker exhausts client memory, causing denial of service","analyst_note":"Confirm affected krb5 version range and fixed release from the NVD entry or MIT krb5 advisory.","how_to_check":"- Check the installed krb5 version with `krb5-config --version` or `klist -V`\n- Look for GSS-RPC client programs (libgssrpc users) in the environment\n- unknown for anything beyond this, the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-gss-rpc-clients"],"who_is_affected":"Systems running MIT Kerberos 5 GSS-RPC client programs that talk to an RPC server over TCP, where an attacker can inject or trigger replies. Hosts that do not use GSS-RPC client code paths are less exposed. unknown for the exact affected version range, the sources do not say.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4595,"output_tokens":570,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected krb5 version range and fixed release from the NVD entry or MIT krb5 advisory.","search":"'-112314':15A,18A '-2026':14A,17A '5':3A,35B,77C 'aka':78C 'allow':90C 'attack':10A,48B,92C 'authent':58B,117C 'call':71C 'caus':66B,94C 'client':5A,31B,63B,105C 'clnttcp':70C 'cve':13A,16A 'denial':67B,96C 'exhaust':11A 'free':39B,82C 'gss':21B,29B,103C 'gss-rpc':20B,28B,102C 'inject':50B,108C 'kerbero':2A,23B,34B,76C 'krb5':19A,24B,36B,79C 'leak':6A,64B,100C 'let':8A 'lib/rpc/clnt_tcp.c':73C 'linux':25B 'make':61B 'memori':7A,65B,99C 'mismatch':54B,112C 'mit':1A,33B,75C 'packag':26B 'program':106C 'remot':9A,47B,91C 'repli':42B,52B,85C,110C 'resourc':12A 'retri':45B,59B,88C,118C 'rpc':4A,22B,30B,41B,51B,84C,104C,109C 'servic':69B,98C 'trigger':57B,116C 'verifi':43B,86C 'xid':55B,113C","nicknames":[],"mitigations":[],"who_affected":"Systems running MIT Kerberos 5 GSS-RPC client programs that talk to an RPC server over TCP, where an attacker can inject or trigger replies. Hosts that do not use GSS-RPC client code paths are less exposed. unknown for the exact affected version range, the sources do not say.","tier":"B","verified":{"fix":{"at":"2026-11-09T19:37:10Z","by":"analyst","doc":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","run_id":2342}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["krb5"],"ptokens":["krb5"],"labels":["gssrpc","high","kerberos","krb5","linux","package"],"campaign_type":null,"search_a":"'-112314':15A,18A '-2026':14A,17A '5':3A 'attack':10A 'client':5A 'cve':13A,16A 'exhaust':11A 'kerbero':2A 'krb5':19A 'leak':6A 'let':8A 'memori':7A 'mit':1A 'remot':9A 'resourc':12A 'rpc':4A","search_b":"'5':35B 'attack':48B 'authent':58B 'caus':66B 'client':31B,63B 'denial':67B 'free':39B 'gss':21B,29B 'gss-rpc':20B,28B 'inject':50B 'kerbero':23B,34B 'krb5':24B,36B 'leak':64B 'linux':25B 'make':61B 'memori':65B 'mismatch':54B 'mit':33B 'packag':26B 'remot':47B 'repli':42B,52B 'retri':45B,59B 'rpc':22B,30B,41B,51B 'servic':69B 'trigger':57B 'verifi':43B 'xid':55B","search_c":"'5':77C 'aka':78C 'allow':90C 'attack':92C 'authent':117C 'call':71C 'caus':94C 'client':105C 'clnttcp':70C 'denial':96C 'free':82C 'gss':103C 'gss-rpc':102C 'inject':108C 'kerbero':76C 'krb5':79C 'leak':100C 'lib/rpc/clnt_tcp.c':73C 'memori':99C 'mismatch':112C 'mit':75C 'program':106C 'remot':91C 'repli':85C,110C 'retri':88C,118C 'rpc':84C,104C,109C 'servic':98C 'trigger':116C 'verifi':86C 'xid':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","severity":null,"published_at":"2026-11-09T19:16:39+00:00","modified_at":"2026-11-09T19:16:39+00:00","first_seen_at":"2026-11-09T19:28:13+00:00","fetched_at":"2026-11-09T19:28:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112314:2342","url":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","severity":null,"published_at":"2026-11-09T19:37:10+00:00","modified_at":"2026-11-09T19:37:10+00:00","first_seen_at":"2026-11-09T19:37:10+00:00","fetched_at":"2026-11-09T19:37:10+00:00","note":"MIT advisory MITKRB5-SA-2026-001 lists CVE-2026-112314 among DoS fixes in 1.22.3; it gives no per-CVE description or affected range, so the bug details come from NVD text only and are unverified. web-cli had no Exa credits. Fixed version verified; affected range unknown.","cites":["https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt"]}],"documents":[{"id":109492,"url":"https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt","title":"MITKRB5-SA-2026-001: Multiple vulnerabilities fixed in 1.22.3","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}